PT-2020-6758 · Zyxel · Zyxel Cloudcnm Secumanager

Alexandre Torres + 2 · Published 2020-06-26 · Updated 2022-10-27 · CVE-2020-15347

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1

Description The issue is related to insufficient protection of credentials in the Zyxel CloudCNM SecuManager software, which can allow a remote attacker to gain full access to devices on the network. The axiros account has a hardcoded password q6xV4aW8bQ4cfD-b.

Recommendations For Zyxel CloudCNM SecuManager versions 3.1.0 and 3.1.1, consider changing the password for the axiros account to prevent unauthorized access. As a temporary workaround, restrict access to the axiros account until a patch is available. Avoid using the default password q6xV4aW8bQ4cfD-b for the axiros account in the affected software.

Exploit

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

BDU:2022-06063

CVE-2020-15347

Affected Products

Zyxel Cloudcnm Secumanager

References · 7

• 🔥 https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html · Exploit
• https://zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15347 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15347 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06063 · Security Note
• https://t.me/cibsecurity/50688 · Telegram Post
• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-vulnerabilities-of-cloudcnm-secumanager · Note